OR
     *cpe:2.3:a:openssh:openssh:9.1:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:openbsd:openssh:9.1:*:*:*:*:*:*:*

MITRE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ [No types assigned]

MITRE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ [No types assigned]

MITRE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/

MITRE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/

AND
     OR
          *cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
     *cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

http://www.openwall.com/lists/oss-security/2023/03/09/2 No Types Assigned

http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ No Types Assigned

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ No Types Assigned

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ Mailing List

https://security.gentoo.org/glsa/202307-01 No Types Assigned

https://security.gentoo.org/glsa/202307-01 Third Party Advisory

https://security.netapp.com/advisory/ntap-20230309-0003/ No Types Assigned

https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory

https://security.gentoo.org/glsa/202307-01 [No Types Assigned]

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ [No Types Assigned]

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ [No Types Assigned]

https://security.netapp.com/advisory/ntap-20230309-0003/ [No Types Assigned]

http://www.openwall.com/lists/oss-security/2023/03/09/2 [No Types Assigned]

NIST AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

http://www.openwall.com/lists/oss-security/2023/02/13/1 No Types Assigned

http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/02/22/1 No Types Assigned

http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/02/22/2 No Types Assigned

http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/02/23/3 No Types Assigned

http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/03/06/1 No Types Assigned

http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/03/06/1 [No Types Assigned]

http://www.openwall.com/lists/oss-security/2023/02/23/3 [No Types Assigned]

http://www.openwall.com/lists/oss-security/2023/02/22/2 [No Types Assigned]

http://www.openwall.com/lists/oss-security/2023/02/22/1 [No Types Assigned]

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration. One third-party report states "remote code execution is theoretically possible."

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

http://www.openwall.com/lists/oss-security/2023/02/13/1 [No Types Assigned]

OR
     *cpe:2.3:a:openssh:openssh:9.1:*:*:*:*:*:*:*

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST CWE-415

https://bugzilla.mindrot.org/show_bug.cgi?id=3522 No Types Assigned

https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit, Issue Tracking, Third Party Advisory

https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig No Types Assigned

https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch, Vendor Advisory

https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 No Types Assigned

https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch, Third Party Advisory

https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ No Types Assigned

https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit, Third Party Advisory

https://news.ycombinator.com/item?id=34711565 No Types Assigned

https://news.ycombinator.com/item?id=34711565 Issue Tracking, Third Party Advisory

https://www.openwall.com/lists/oss-security/2023/02/02/2 No Types Assigned

https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit, Mailing List, Third Party Advisory

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that "exploiting this vulnerability will not be easy."

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration. One third-party report states "remote code execution is theoretically possible."

https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ [No Types Assigned]

https://news.ycombinator.com/item?id=34711565 [No Types Assigned]